Medium Severity
Open redirect: typedrawers.com
Description
Detects messages containing links or QR codes pointing to typedrawers.com/home/leaving with target parameter, sent from non-trusted domains or authenticated sources failing DMARC checks. Considers sender reputation and requires either unsolicited contact or prior malicious activity without false positives.
References
No references.
Sublime Security
Created Nov 26th, 2024 • Last updated May 23rd, 2025
Feed Source
Sublime Core Feed
Source
type.inbound
and (
any(body.links,
.href_url.domain.root_domain == "typedrawers.com"
and .href_url.path == "/home/leaving"
and strings.icontains(.href_url.query_params, 'target=')
)
or any(attachments,
(
.file_type in $file_types_images
or .file_extension in $file_extensions_macros
or .file_type == "pdf"
)
and any(file.explode(.),
.scan.qr.type == "url"
and .scan.qr.url.domain.root_domain == "typedrawers.com"
and .scan.qr.url.path == "/home/leaving"
and strings.icontains(.scan.qr.url.query_params, 'target=')
)
)
)
// negate highly trusted sender domains unless they fail DMARC authentication
and (
(
(
sender.email.domain.root_domain in $high_trust_sender_root_domains
or sender.email.domain.root_domain == "typedrawers.com"
)
and not headers.auth_summary.dmarc.pass
)
or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)
Playground
Test against your own EMLs or sample data.